Exploitation Summary
CVE-2025-24000 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including bsdrip.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-24000, a privilege escalation vulnerability in the Post SMTP WordPress plugin (≤ 3.2.0). The exploit allows a low-privilege user to access admin email logs, extract a password reset link, and take over the administrator account.
Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
Exploits (1)
This repository contains a functional Python exploit for CVE-2025-24000, a privilege escalation vulnerability in the Post SMTP WordPress plugin (≤ 3.2.0). The exploit allows a low-privilege user to access admin email logs, extract a password reset link, and take over the administrator account.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H